Applied Network Science

Table 6 Results of direct attacks against each classifier with the Cora dataset, with attacker budgets of 5, 10, and 20 edge perturbations

From: Complex network effects on the robustness of graph convolutional networks

		Budget 5			Budget 10			Budget 20
Defense	Training	Net	FGA	IG	Net	FGA	IG	Net	FGA	IG
Jaccard	Rand.	0.504	0.328	N/A	0.712	0.48	N/A	0.952	0.68	N/A
Jaccard	SD	0.448	0.216	N/A	0.656	0.36	N/A	0.776	0.552	N/A
Jaccard	GC	0.528	0.296	N/A	0.76	0.424	N/A	0.912	0.616	N/A
RGCN	Rand.	0.936	0.896	N/A	0.984	0.992	N/A	0.992	0.992	N/A
RGCN	SD	0.944	0.832	N/A	1.0	0.952	N/A	1.0	0.96	N/A
RGCN	GC	0.976	0.84	0.832	1.0	0.96	0.976	1.0	0.96	0.976
Cheb	Rand.	0.88	0.728	N/A	0.976	0.928	N/A	0.984	0.96	N/A
Cheb	SD	0.96	0.752	N/A	1.0	0.928	N/A	1.0	0.936	N/A
Cheb	GC	0.944	0.816	N/A	0.992	0.952	N/A	1.0	0.96	N/A
SVD	Rand.	*0.36*	0.24	N/A	0.776	0.592	N/A	0.992	0.928	N/A
SVD	SD	0.696	0.288	N/A	0.936	0.632	N/A	1.0	0.92	N/A
SVD	GC	0.432	0.184	N/A	0.792	0.448	N/A	1.0	0.84	N/A
median	Rand.	0.936	0.768	0.824	0.992	0.96	0.968	1.0	0.976	0.992
median	SD	0.968	0.864	0.864	1.0	0.952	0.984	1.0	0.952	0.984
median	GC	0.912	0.824	0.824	1.0	0.968	0.976	1.0	0.968	0.976
GAT	Rand.	0.944	0.856	N/A	1.0	0.96	N/A	1.0	0.968	N/A
GAT	SD	0.928	0.736	N/A	1.0	0.92	N/A	1.0	0.968	N/A
GAT	GC	0.92	0.824	N/A	1.0	0.952	N/A	1.0	0.984	N/A
GCN	Rand.	0.928	0.888	N/A	0.992	0.976	N/A	1.0	0.976	N/A
GCN	SD	0.928	0.624	0.904	0.992	0.944	0.992	1.0	0.968	0.992
GCN	GC	0.904	0.832	0.808	0.992	0.976	0.984	1.0	0.984	0.992
SGC	Rand.	0.896	N/A	N/A	1.0	N/A	N/A	1.0	N/A	N/A
SGC	SD	0.944	N/A	N/A	1.0	N/A	N/A	1.0	N/A	N/A
SGC	GC	0.904	N/A	N/A	1.0	N/A	N/A	1.0	N/A	N/A

Results are included for Nettack (Net), FGA, and IG-FGSM (IG). For each classifier, we train with random (Rand.), StratDegree (SD), and GreedyCover (GC). Each entry is a probability of attack success, thus higher is better for the attacker and lower is better for the defender. To yield the most robust classifier, the defender picks the classifier/training method combination that minimizes the worst-case attack probability. These entries are listed in bold. Entries representing the most robust case for random training are in italic. Entries listed as N/A did not finish in the allotted time (24 h per trial). While random training with the SVD classifier works best at a low attack budget, Jaccard with StratDegree performs better against better-resourced attackers

Back to article page